The DMZ

AviD

10:01

oy.

@AviD The answers to the two questions you asked in your comment eight minutes ago are both affirmative. — ntoskrnl 6 mins ago

@ntoskrnl .... To be clear. You are actually seriously stating that: 1. nonsandboxed applets can never have security flaws. 2. There are no such thing as security flaws besides permissions bypass. Did I understand correctly? And you're not drunk? — AviD ♦ 18 secs ago

too harsh?

@Adnan he didnt say its more severe, he was saying there is no such thing.

Adnan

@AviD Ahhhh... I'll explain.

AviD

@Adnan yaaaaay.

Adnan

Basically, he's, analogically speaking, saying that since with physical access you can do whatever you want to the machine, you don't really have to care about remote attacks.

The error here is assuming that all possible attacks are physical

Compared to physical attacks (physical access), remote attacks are indeed less sever. That's correct.

However, that doesn't mean all attacks are physical.

AviD

yeah, that sounds about right. but that just proves @TerryChia right.

Adnan

@AviD Wait, let me finish.

2

AviD

10:07

@Adnan TWSS!!

Terry Chia

@AviD Dammit! I was going to say that!

AviD

heehee

Adnan

Back to the Java situation: If I gave you a native Java application that runs in the background and logs your keys and sends them to me, then I compromised you without using any JVM vulnerabilities, right?

AviD

ummm....

Adnan

Not done yet..

This makes us, rightfully, think that executing non-applet applications on your computer is game over. No JVM vulnerabilities needed whatsoever.

Which, in some people, leads to a logical error and they think that JVM vulnerabilities (while they DO exist) are irrelevant to non-applet apps.

That's what the dude is claiming.

In that part, he's wrong.

Terry Chia

10:11

That's a really roundabout way of repeating what I have said three times already. "He's an idiot."

AviD

4 mins ago, by AviD

yeah, that sounds about right. but that just proves @TerryChia right.

Adnan

@TerryChia While understanding your joke, I disagree with you.

Just saying he's an idiot doesn't help anybody

Now I'll just summarize my argument here and post it as a comment. Hopefully, that'll make him understand.

If he did understand and change his mind, that's one less ignorant person in the world.

I like that.

Saying he's an idiot is very dismissive and should only be used if he displayed complete lack of interest in learning.

AviD

@Adnan it helps me, so I dont have to implode my brain trying to figure out what I missed.

Terry Chia

See, I'm not trying to be helpful hence why I said it in chat instead of leaving a comment. :P

Adnan

@AviD Now you know what you missed. Win win.

AviD

10:14

@Adnan but I didn't miss anything this time.

@Adnan oh, that I agree with.

Adnan

Anyway, @ntoskrnl dude reading this, continue reading here: The greatest mistake you made here is to think that all attacks happen by asking people to execute code on their machine. The real situation is that Java applications can run on your machine, listen on ports, wait for connections from outside, and, if there's a vulnerability in the JVM, could possibly lead remote users to execute code on your machine without you running that code.

@AviD Good, now that I explained, you can see that you already thought the same and that you were right all along and you didn't miss anything. Without the explanation, you'd think the same, but you'd base it on him being an idiot. Now can base it on actual facts.

AviD

@Adnan I thought the greatest mistake was believing the devil doesn't exist?

@Adnan I never said he was an idiot!! That was all @TerryChia.

28 mins ago, by AviD

@TerryChia I dont think so, at least not usually.

Adnan

@AviD To continue this nonsense festival, let's all whip our dicks out and just wiggle them around. It would certainly make more sense than this argument.

UGGHHHH!

AviD

@Adnan yes, I'm sure you would enjoy that. Proper Finnish Festival.

Terry Chia

@Adnan You must love the starwall don't you?

Adnan

10:22

@TerryChia Oh god. I have just understood the possible euphemism in what @Kisunminttu said about mechanical keyboards. It already got 2 stars.. ahhh :(

Scandalous!

AviD

heehee

Adnan

Hehehehehehe oh god! I'm talking to one of the not-so-regular DMZ guys on IRC and he made a comment about @Kisunminttu.

"So, you finally created a sockpuppet account for your hand"

3

Not cool.

AviD

hey @TerryChia since you love heartbleed so much, we now give you.... heartbeat!!

ntoskrnl

@Adnan Alright, I got it now, there could be vulnerabilities in, say, the networking code or the ZIP library that could compromise a Java server.

Terry Chia

@AviD FUUUUUUUUUU!

AviD

10:30

@ntoskrnl yes, for example. Also there are other classes of vulnerabilities, besides sandbox-escape.

Thanks for popping in to clear this up!

and @Adnan thanks for explaining much better what I didnt understand....

ntoskrnl

@Adnan But... 1) Have there been any such vulnerabilities? I haven't looked through all of them but all I've seen are sandbox escape vulnerabilities. 2) Are they actually relevant to end-users? Only applets run without user consent, and they are sandboxed.

AviD

@ntoskrnl those are fair points, for (1) I havent actually checked, but I would assume there is (even if its a minority). (2) for the most part not so much, but more because most mainstream users dont run Java client applications so often.

moreover, and much more important - just because I consented to running a program, doesnt mean that program can't have any vulnerabilities.

for example - how many vulnerabilities have there been in MSWORD.exe?

Terry Chia

Again, why restrict this only to client apps?

AviD

@TerryChia that too.

ntoskrnl

I see, fair enough. A malicious image or ZIP or whatever could indeed do something nasty.

But I still think the applet sandbox vulnerabilities are the only reason, if there is any, to panic and uninstall Java as an end-user.

AviD

10:38

@ntoskrnl that's a big "if".

there is rarely reason to panic.

uninstalling Java, on the other hand, might make sense for a lot more reasons than just security.

ntoskrnl

I don't see mainstream news sources urging everybody to uninstall Word because it has vulnerabilities. Thats's because those vulnerabilities don't allow drive-by download of malware. Why would the situation be different for Java?

AviD

@ntoskrnl why should it, indeed?

ntoskrnl

@AviD Perhaps, then, it is unreasonable to consider Java as a whole to be fatally insecure when the serious vulnerabilities only concern the applet sandbox.

Terry Chia

No one ever said Java was fatally insecure....

CodesInChaos

@TerryChia There are many who do

Terry Chia

10:44

@CodesInChaos Ok. No one here ever said Java was fatally insecure.

Adnan

@ntoskrnl Glad everything is clear now.

Now let's drink.

More quality report from Finnish news. I pay taxes for this, ladies and gents.

yle.fi/uutiset/decoding_finnish_teenspeak/7183959

> swag: a confident, sexy, well-dressed person who doesn’t care what others think – or an insult for someone who sees him or herself this way

@deed02392 Sigh

AviD

@TerryChia @ntoskrnl this.

@Adnan are finnish teens really so confused?

Adnan

@AviD Remove "Finnish" from that question you'll answer it yourself.

Ladadadada

Interesting HeartBleed email:

"Load Impact has only been vulnerable to this bug for the past six months and since you have not logged on to your Load Impact account during this period, your account is safe."

AviD

@Ladadadada you got a security email from your porn site?

Adnan

10:53

@AviD That's a porn site?

Ladadadada

Wait... Load Impact is a porn site? This is the "Ops Team" email address where I work.

AviD

@Adnan "Load Impact"? I dunno, just assumed.

Adnan

@AviD Well, apparently it's not.

AviD

heheh

Terry Chia

@Ladadadada Wut.

Ladadadada

10:55

I didn't even know we had a Load Impact account. We probably haven't logged in to it in two years.

CodesInChaos

Coincidentally somebody found a buffer overflow in my own crypto lib yesterday. Luckily C# simply throws an ArrayIndexOutOfBoundsException instead of overwriting anything important.

Thomas Pornin

@TerryChia It seems to be a debate about implementation of GCM and side-channel attacks exploiting cache misses for table accesses.

Whether such attacks really work in "normal" conditions is open to debate.

Whether doing encryption at more than 100 MBytes/s is worth the effort is also open to debate

Terry Chia

@ThomasPornin GCM and side channels aren't really my strong suit but the issue is about whether GCM with table lookups can ever be safe.

AviD

3

Q: Log Attacks in Different Files using Snort

How can I log attacks separately using snort. I basically want to log attacks invoked from different files separately. Like if I have 2 files, ddos.rules and log.rules, then I want logs generated from ddos.rules in one file and logs generated from log.rules in another. Is it possible, and if so ...

@ScottPack and others - I agree this is not unclear, but is it really ontopic?

Thomas Pornin

@TerryChia People who believe in cache-based side-channel attack will never believe that anything which uses tables is safe.

AviD

11:02

"how do I configure X" was always more SU/SF...

Thomas Pornin

Precisely, anything which uses data-dependent table accesses.

CodesInChaos

These attacks are mostly an issue if you have hostile code running on the same machine (isolated by process or VM separation)

Remote timing attacks are a bit exaggerated IMO.

Thomas Pornin

@CodesInChaos My usual stance is that if this model applies, then you are doomed anyway.

Concentrating on the private/secret key alone is relevant only if that key is the only secret piece of data in the machine.

CodesInChaos

With all that cloud stuff it unfortunately becomes more important to be isolated from other VMs running on the same machine.

Thomas Pornin

Therefore I admit the relevance of cache-based attacks for signature algorithms and MAC, but not really for anything else.

CodesInChaos

11:07

GHash is a MAC, and a relatively fragile one at that

But it's a bit weird to worry about every minimal timing attack in the crypto code and not even thinking about timing/cache/... attacks against the application on top of that.

Terry Chia

@ThomasPornin @CodesInChaos So I guess the consensus between the two of you is that it probably isn't that large of a problem? Either one of you mind dropping a comment on that issue saying so? :)

Having someone with more crypto experience weigh in will be helpful.

CodesInChaos

I'm a fan of using constant time code, mainly because then I don't need to figure out if/when the side channel is exploitable.

I'd recommend constant time code as default and only switch to variable time code if that's too slow. But in that case you probably should use AES-NI which allows extremely fast constant time implementations of AES-GCM.

deed02392

11:36

@Adnan What's up?

Scott Pack

@AviD We've never toed as hard a line about it as your comment suggests. General purpose tool use almost always gets migrated yes but security configurations or advanced configurations of security tools has generally been kept.

AviD

11:53

@ScottPack you say that every time we migrate a security configuration question... ;-)

okay, forget what we've done - what should we do?

Adnan

@deed02392 Go up a few lines before that one.

AviD

do you think that type of question should stay?

deed02392

ahh the yle link haha

chillata LOL

Katso vittu Googlesta

Plenty of times I'd love to use that one

that was quite entertaining

Adnan

@deed02392 Now I'll start using KVG

KVG = "Look it up on fucking Google"

deed02392

and only you and I will know what the hell you're saying

oh, unless you write the translation

Adnan

12:03

@deed02392 Hmm.. For some reason, I feel that "vittu" (in that context) is much stronger than "fucking".

To me, it feels more offensive

0

Q: Does heartbleed effect effect electronic voting

Is electronic voting software compromised by the heartbleed issue?

heartbleed electronic-voting

Please.. make it stop!

Scott Pack

@AviD That's because the things that we've generally kept here are ones that won't get answered at other sites or will get terrible answers because the community who can answer them best is here.

Adnan

I'll admit and regret every action I've ever committed in my life. Please.. just.. make this heartbleed fingerfest stop!

Nathan C

@Adnan It'll hopefully be over in a couple days...SF has been getting tons of those too

AviD

@ScottPack fair enough.

@Adnan I'm working through the list right now. Reading every damn heartbleed question.

deed02392

@Adnan Hahaha

AviD

12:06

Heartbleed? More like eyebleed.

tbh, so far most of the question I'm reading (not counting the already closed ones) are sustainable.

but the mass hysteria, asking scores of questions on a single, boring vuln in 2 days is just... urggh.

Scott Pack

You have to have a heart before it can bleed, @AviD.

AviD

It's just so kardashian of them .

Scott Pack

Wait, that's what we're doing now?

kardashian == fed up?

Adnan

@NathanC I hope so.

TildalWave

@AviD vine don't ask me where it comes from, prolly misspelled from a clock winding crank?

Scott Pack

12:08

Ohai @AviD. @Adnan. The FAQ says questions about security tools are on topic.

AviD

@ScottPack about them, sure. How to use them? not so much.

TildalWave

also interesting today, the world is still here ...

AviD

@ScottPack "famous for being famous".

TildalWave

hai guise

AviD

@ScottPack "talking about this vuln because everybody is talking about the vuln."

Scott Pack

12:10

@AviD It's not specified. Just "Topics include, but are not limited to: security tools"

There's a bunch of other bullet points in there but I edited them out for readability.

Personally, I find the openssl thing pretty interesting. Mostly because it was so easily exploited, lasted for so long before it was found, and because of what it does.

I'm not so hipster that I can't admit to liking it.

AviD

@ScottPack oh that I agree with. its the hysteria and panic, all based on non-understanding, that is bothering everybody.

also the bug itself is not really a new thing, its just an interesting context for it.

Scott Pack

News media man.

Right

AviD

"MediaMan". Great name for a current events-based superhero.

@ScottPack hmm. I thought I remembered that differently, I also thought I remembered a meta post on this. It seems I may have been wrong.

right, flag that snort q for reopening and I'll hammer that open.

Thomas Pornin

@CodesInChaos @TerryChia I second that.

Performance is never an issue until it has been duly measured, and found lacking in the actual usage context.

Personally I like constant-time algorithms for their mathematical elegance; but I also recognize that they are convenient to shut up the horde of cache-timer scarecrows.

Rоry McCune

13:30

@AviD so what you're saying is that we should be starting an indiegogo campaign to buy you whisky to dull the pain...

AviD

ooh yeah. that might help.

Rоry McCune

oh lord

AviD

13:47

hehe

Xander

@Adnan Ha. Too bad it was a crap question (or off-topic, at least) and has already been closed.

Rоry McCune

this'll be interesting if proven

eff.org/deeplinks/2014/04/…

Xander

14:30

@AviD I like to use the model you taught me for questions containing code. Is it a question you'd ask a programmer, or a security guy? I think the same holds for configuration questions. If you're trying to config the app in your office, are you going to go to a sys/net/admin for help, or the help desk, or the security team? If the security team, it stays.

deed02392

14:41

I hate it when the word 'else' is used in articles, my mind always freaks out that it's not immediately followed by a {

AviD

@Xander excellent point.

tbh I have no idea who to ask that snort question. I'm an apps man.

in which case I should just trust the @Scott.

damn. So I spent the last I dunno how many hours reading through all the heartblood q's. Finally done - and there's another handful waiting for me.

Rоry McCune

►

...

AviD

14:59

@TerryChia @Adnan so I've looked at all the questions in that tag.

EVERY.STINKING.ONE.

Truthfully theyre not all bad, some decent ones. Hype notwithstanding.

I was a bit aggressive in closings though, so if anyone disagrees with one - please do flag it ASAP and we can remedy.

@TerryChia @Adnan let me know if there are still any actual problems there, besides the annoying hysteria, panic, and hype.

Scott Pack

Wait. @AviD said something good about me. I should read what happened.

AviD

@ScottPack I always say something good about you.

Except when you want me to talk nasty.

Scott Pack

TildalWave

15:15

So you all changed your passwords, didn't you? :D

Rory Alsop

Hahahaha - not really. All mine are different anyway, and I'm only changing ones once those sites are updated

AviD

crap, these fartbreed questions keep coming in!

TildalWave

I'll change from "password" to "password123" just in case :)

AviD

probably the highest velocity tag we've ever had.

Thomas Pornin

@AviD Personally I am waiting for some economist to make a study comparing the cost of the panic with that of the actual vulnerability.

AviD

15:19

@ThomasPornin as is often the case....

TildalWave

@ThomasPornin I did wonder how many side attack channels are now free to exploit with everyone concentrating their forces on one thing

Thomas Pornin

Schneier himself is losing it: schneier.com/blog/archives/2014/04/heartbleed.html

AviD

@ThomasPornin inorite?

Thomas Pornin

> At this point, the probability is close to one that every target has had its private keys extracted by multiple intelligence agencies.

That's what he says.

AviD

@TildalWave yeah, it's practically a DoS on the CAs,

TildalWave

15:21

@ThomasPornin OMG did he just use "this one goes to 11" in his post?

Thomas Pornin

Though he also prophecises this:

> I wonder if there is going to be some backlash from the mainstream press and the public. If nothing really bad happens -- if this turns out to be something like the Y2K bug -- then we are going to face criticisms of crying wolf.

TildalWave

moar cowbells!

AviD

@RoryAlsop aye. and only if the site actually SAYS something about it.

yaaaay, we've hit 60 in that tag!

Thomas Pornin

@AviD If I were into conspiracy theories, I would say that this all looks like an elaborate ploy to kill OpenSSL altogether. Which would point at Microsoft as the plausible suspect (they are used to it).

TildalWave

@AviD that's what my worry is yup... actually, strike that, I had my coffee... I don't worry :)

AviD

15:22

@ThomasPornin or, maybe to garner attention and support?

supposedly the community behind it has been languishing, and in need of more contributors.

@RoryAlsop have you seen the analytics today?

holy views spike, @Batman!

TildalWave

@AviD quanto?

or is it quando? meh ...

ah no, that's "when"

lol it's not even with "q" it's with "c" sorry

AviD

nevermind, not getting into specifics but lets just say the past 2 days have had more traffic than any other week in the past year.

TildalWave

anyway, how many folks yesterday?

David Freitag

@AviD I think that might be related to CNN's coverage of Heartbleed

TildalWave

we'll see it on quantcast in a day anyway, so why hold it back? :P

AviD

15:27

@DavidFreitag ya thank?

@TildalWave Mod agreement...

TildalWave

@AviD don't you pull that one on me mister!

AviD

heh.

interestingly, when graphing since graduation, even today's spike is dwarfed by May 2012.

TildalWave

there, available for everyone: quantcast.com/security.stackexchange.com

says it's gone from average of about 30k to 90k

AviD

okay, I am sick of all these "Is X vulnerable to Heartbleed?" "Is Y vulnerable to Heartbleed?" "Is Z vulnerable to Heartbleed?"

anyone want to write a canonical q/a on "Is X vulnerable to Heartbleed? (for any values of X)"

Terry Chia

@AviD No, no, yes you are fucked.

AviD

15:31

LOL

TildalWave

@AviD where's @LucasKauffman when you need him?

AviD

@TildalWave I think easy a half-dozen questions could immediately be closed as dupe of that one. probably more.

Rоry McCune

@TildalWave I thought he was writing a piece up on HB at the moment...

AviD

@RоryMcCune yeah, but on the blog. I cant close a q as dupe of the blog.

TildalWave

@RоryMcCune Yes, in Dutch, right?

Rоry McCune

15:33

@AviD actually the missus suggested a good feature we should ask for for the site. We could have a banner box for events like this which had a blog posting/canonical questions

like a FAQ

would need to be something the Mods could set-up

AviD

@RоryMcCune that.... would actually be awesome.

we could set up a system message, if we had a blog post it might make sense to do so. /cc @LucasKauffman

Rоry McCune

@AviD yeah thought it might be a handy way of reducing the flow of people not reading down the page before posting...

AviD

meh, who we kidding, they still wouldnt read it.

TildalWave

@AviD Oh I don't disagree ... and need I say that most are just crap? It's almost like "I've seen the other guy ask a question because he's scared, but I'm scared too and this is not a dupe because I'm not him, so should I be?"

AviD

but @RoryAlsop ^ - that actually could be doable now.

@TildalWave hehe, nicely put.

TildalWave

15:37

OK, my intuition tells me that THIS is gonna create more problems than the bleeping heartbleep:

> EDITED TO ADD (4/10): I'm hearing that the CAs are completely clogged, trying to reissue so many new certificates. And I'm not sure we have anything close to the infrastructure necessary to revoke half a million certificates.

from Schneier's post

M'vy

heya guys!

Thomas Pornin

@TildalWave Oh yeah, the CRL will be huge.

A good thing that nobody checks CRL anyway.

M'vy

XD

Terry Chia

@M'vy Hello!

Thomas Pornin

The revocation system will go from "nobody uses it because we are lazy" to "nobody uses it because we are lazy and we broke it".

Terry Chia

15:39

@ThomasPornin So all is well with the world. :P

M'vy

This is the end of the world as we know it

TildalWave

@M'vy hey there ;)

Where that Douglas Adams quote when you need it?

M'vy

So long and thanks for all the fish?

Thomas Pornin

@M'vy I'm tempted to say "good riddance" if that means that we stop hearing about all this Heartbarf business, and can resume concentrating on sane, reasonable things like Gangnam Style.

6

TildalWave

... some argue that this has already happened one

AviD

15:41

@TildalWave thats what I said

M'vy

@ThomasPornin :P

@TildalWave oh, the understanding of the universe

AviD

@ThomasPornin right, everybody uses OCSP now.

TildalWave

@M'vy the whole intro actually ... from the primal mistake of climbing off the trees to finding wrist watches fascinating

M'vy

@TildalWave I could probably find the quote somewhere. Unfortunately, it would be in French

Such a problem to get original books...

TildalWave

it's OK we probably all read it anyway ;)

AviD

15:44

@M'vy I'm sure you can find it here

Phrases from The Hitchhiker's Guide to the Galaxy

The Hitchhiker's Guide to the Galaxy is a comic science fiction series created by Douglas Adams that has become popular among fans of the genre(s) and members of the scientific community. Phrases from it are widely recognised and often used in reference to, but outside the context of, the source material. Many writers on popular science, such as Fred Alan Wolf, Paul Davies and Michio Kaku, have used quotations in their books to illustrate facts about cosmology or philosophy. Answer to the Ultimate Question of Life, the Universe, and Everything (42) In the radio series and the first ...

M'vy

damn there is a whole page about phrases from the books?!

David Freitag

@M'vy So long and thanks for all the fish?

AviD

I have a feeling this is the one you meant?

> Narrator: There is a theory which states that if ever anyone discovers exactly what the Universe is for and why it is here, it will instantly disappear and be replaced by something even more bizarre and inexplicable.

There is another theory, which states that this has already happened.

M'vy

@AviD yep.

TildalWave

I'm just going through some of the latest questions ... I'm making a big mistake, ain't I?

M'vy

15:49

@TildalWave got that about the wristwatch. Seems to be the introduction of the first book. heretical.com/miscella/hhg.html

oh by the way. I found a new job.

AviD

congrats!

Rory Alsop

Yay @Mvy.

TildalWave

@M'vy grats! what are you into now?

Rory Alsop

@AviD not seen the stats yet. Not home for another couple of hours

AviD

@RoryAlsop spikey.

M'vy

15:52

Well not security, but it's R&D at least

Rory Alsop

But not as spiky as the annoying spike that stops us doing a sensible graph from beta

TildalWave

oh R&D is cool, that's my area then ... OK, I like the R more than the D, but they go hand in hand otherwise it's all academic

AviD

@RoryAlsop yup

do you remember what happened in May 2012?

the spike to dwarf all other spikes.

M'vy

I just need to sign the contract next week, and I'll start the 22nd.

The Heartbleed Hit List: The Passwords You Need to Change Right Now: http://mashable.com/2014/04/09/heartbleed-bug-websites-affected/ via @mashable

Tweeted by securityprivacy on April 10, 2014 at 3:53 PM

Rory Alsop

@AviD I did remember last time I tried, buy I can't remember now.

user35386

15:57

security expertise might be helpful for this question: superuser.com/questions/739955/…

AviD

thoughts on this - note the comments requesting reopening? (I am too heartbloody by now... )

0

Q: Can an external tool accurately determine the current vulnerability of a site to Heartbleed? How? Was vulnerability remediated?

Can an external tool accurately determine the current vulnerability of a site to Heartbleed? If so, how? What has to be tested/tested for? What features are required? vvvvvvvvvv UPDATE 1 What features are required to determine if a vulnerable site was remediated? How does one determine that i...

heartbleed

AviD

16:13

yknow what's worse than reading all the heartblood questions on the site?

Reading all the heartblood answers on Super User.

M'vy

:)

TildalWave

@AviD there's just 13 of them superuser.com/questions/tagged/heartbleed we currenly have 61

at least that were tagged as such

AviD

@TildalWave yeah, but at least here most of the answers are pretty sensible.

TildalWave

BTW if you get tired of this, we don't have a single question about heartblimp on space.se :P

no, don't!

:)

don't ask one!!

"Are any satellites in Earth's orbit affected by heartbleed?"

7

AviD

@TildalWave ha, luvvit!

but too generic. it should be: "Is this satellite affected?" and "is that shuttle affected?"

TildalWave

16:23

@AviD Shuttle? They've been retired now for quite some time :P

AviD

ehhh whatever

TildalWave

LOL

In Space, No One Can Hear You Heartbleed!

OK I'm going from cranky to corny, time to switch from coffee to beer...

CodesInChaos

16:50

@TildalWave That only makes the question better

Scott Pack

So. There's an assessment tool that will ask a bunch of questions and spit out 80% of an assessment doc. It's 'seasec' or 'sesec' or something.

Google is tricky. Sound familiar to anyone?

AviD

@ScottPack CSEC?

guessing, that seems to make more sense....

@ScottPack assessment of what?

Xander

CUSTOMERS: WE ARE UNAFFECTED BY THE #HEARTBLEED VULNERABILITY AS WE’VE NEVER BEEN SECURE TO BEGIN WITH ABSTENTION IS THE SAFEST PREVENTION

Tweeted by PHP_CEO on April 9, 2014 at 11:00 PM

// via @Poly

AviD

17:07

thats a funny feed

dont tell @Adnan

David Freitag

Mmmm love me that monstercat. 16 is the best yet

Scott Pack

@AviD We have some compliance requirements so I'm looking at doing an assessment as part of a gap analysis. I'm new to this regs so I'm figuring out what we have to do so I can drive priority.

Rоry McCune

hey @AviD is working really late a common Israeli thing?

Scott Pack

17:26

@AviD My boss was told about it at a lunch meeting so all he got was the pronunciation, and there are lots of things with similar acronyms.

tylerl

17:36

Client: Can you explain the process in more general terms, then?
Me: The steps are: (1) understand what sort of code to write, and (2) write that code.

TildalWave

If you're tired of heartbleeding you can watch a rocket launch instead: ulalaunch.com/site/pages/Webcast.shtml :P

Xander

@tylerl Those are indeed general terms.

TildalWave

@RoryAlsop and @Iszi if you're interested, we have a launch with ignition in ~ 3 minutes ^

David Freitag

Why do companies feel the need to reinvent the wheel every time they get the chance?

Thomas Pornin

@DavidFreitag It is harder to patent it if you don't make at least token efforts at (re)inventing it.

Rоry McCune

17:50

@DavidFreitag money

Simon

I refuse to read exactly what the Heartbleed bug is, I'm not cool enough.

Rory Alsop

@RоryMcCune look what arrived :-)

Simon

BOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOZE

Rory Alsop

Thanks @Adnan

Oh, and the kids just stared at the mountain of chocolate things

Rоry McCune

@RoryAlsop indeed thanks @Adnan :)

@RoryAlsop woo

David Freitag

17:53

@ThomasPornin Yeah but if there is an existing infrastructure why not leverage it so save you buckets of money?

What i mean is, a company who has an existing device such as a sewing machine or something like that where they make the decision to implement some external storage medium

Instead of using something like an SD card a company goes out of its way to design a proprietary card system that barely works

Does. Not. Understand.

@RоryMcCune And that's broken logic because it would cost them more money in R&D to develop this card rather than just buying off the shelf existing products.

TildalWave

@RoryAlsop Looks cute, what's that tiny mint something bottle? Looks like something you gotta be careful with :)

David Freitag

@TildalWave The small one is Minttu i believe

Rоry McCune

@DavidFreitag sure but can they sell the propietary version to their customers?

Xander

@DavidFreitag Maybe they don't know about SD cards. Maybe they think they're the first to ever need a removable storage device.

David Freitag

@RоryMcCune Yes they have and they are.

Xander

17:56

@DavidFreitag Bingo.

Rory Alsop

@TildalWave It's a single shot of mint spirit

David Freitag

@Xander I really hope not

TildalWave

ah, never had it

Minttu

Minttu liqueur a clear peppermint liqueur produced in Turku by Pernod Ricard Finland (previously owned by Vin & Sprit). Its clear colour is due to a special type of sugar. Minttu has a strong, crisp taste and scent of peppermint. The taste is quite similar to Crème de menthe, but appearance is more like vodka. The Minttu range consists of Minttu Peppermint 40% and 50% alcohol by volume, and Minttu Black Mint 35% alc. Minttu Black Mint is peppermint liqueur spiced with salmiac. Most common ways to enjoy Minttu are to drink it as an ice cold shot or on the rocks. In Finland, it is ofte...

Xander

@DavidFreitag You never know. Have you asked them?

Rory Alsop

I have opened the bottle of liquorice liqueur and sniffed it - smells awesome

@TildalWave ahhh - it's by pernod

Rоry McCune

17:57

@DavidFreitag then money :) Proprietary storage == lock-in (stops customers going elsewhere for their product) also justifies a higher price tag (customer can't compare with other solutions)

Iszi

@TildalWave Buried in high-priority hair-on-fire stuff right now, so I had to miss it. Felt it though.

David Freitag

@RоryMcCune Yeah i was thinking that too, but you can just as easily implement the locks in software

TildalWave

@Iszi ah you're close enough, right I forgot ... the launch wasn't with much detail anyway since it was a classified payload but it looked cool, the weather was nice too

Xander

@RоryMcCune @DavidFreitag Yup. Also accessories (such as storage cards) typically have huge markups, which == big profits. This is one of the theories on why every cell phone manufacturer designed a different charging connector for every phone they would ever make until the EU told them all to use MicroUSB or else.

David Freitag

@Xander Yeah but they could always package the card in some "removable storage addon" that is equally as marked up

Transcript for